CVE-2026-43581

Katalog CVE

CVSS 9.6 · Critical EPSS 0,36%

Kerentanan Initialization of a Resource with an Insecure Default pada openclaw. Skor CVSS 3.1 9.6 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber vulncheck.com
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-525j-hqq2-66r4 mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/fbf11ebdb7110632f93926d0ac7b48f04cb44d77 patch
• https://www.vulncheck.com/advisories/openclaw-chrome-devtools-protocol-exposure-via-overly-broad-cdp-relay-bin... advisory pihak ketiga